I am getting annoying mail spam to non-existent addresses at my site. It of course fails, but it clogs up the logs. Since I don’t have the source IP addresses, is there any way I can block email by source address? I know they keep jumping around, but I am looking for suggestions. My Discourse is self hosted.
this topic may help if you haven’t seen it yet:
You can filter most spammer IP addresses from the logs using this command (it’s not strictly a RFC requirement, but almost all spam relays don’t have a valid PTR)
./launcher logs mail-receiver | grep -v 'unknown' | grep -E 'NOQUEUE'
If you are getting spam from seemingly legit server it is still difficult to block senders using an email domain, as it can be easily spoofed, so your best bet is to find the IP of the sending SMTP server and block it
./launcher logs mail-receiver | grep -E '[0-9A-F]{10,}:.+(from=<[^>]|client=)'
First result in a pair will give you a SMTP server IP, and the second one will give you a sender address.
You can use the instructions described in
to configure the mail-receiver. I’ve eliminated almost all spam using this approach.
That sounds like a minor administrative inconvenience - compare it to the impact of a less-than-perfect block preventing a real person from making a real contribution to your forum. Personally, I wouldn’t use any kind of blocking, because I never want to lose valid input, even if the cost is that I get some invalid input.